ENG-7072 changed user permissions to one-time computation

No need to check for existence because it's a set, simply `user.m_permissions.addAll()`.